Last revised: May 20, 2015

PRIVACY STATEMENT

The purpose of this Privacy Statement is to inform you about the types of Personal Information that Noodles & Company (as follows, “Noodles & Company” “we” or “us”) collects, uses and discloses. It explains how we use and disclose that information, the choices you have regarding such use and disclosure, and how you may correct that information.

We are proud to demonstrate our commitment to your privacy by complying with applicable privacy laws in Canada, including the Personal Information Protection and Electronic Documents Act and any regulations made thereunder.

From time to time, we may make changes to this Privacy Statement. The Privacy Statement is current as of the “last revised” date which appears at the top of this page. We will treat Personal Information in a manner consistent with the Privacy Statement under which it was collected, unless we have your consent to treat it differently. This Privacy Statement applies to any information we collect or receive about you, from any source.

The following topics will be covered in this Privacy Statement:

1. What is Personal Information?

2. How do we collect your Personal Information?

3. Where do we store your Personal Information?

4. How do we use your Personal Information?

5. To whom do we provide your Personal Information?

6. When and how do we obtain your consent?

7. How do we ensure the privacy of your Personal Information when dealing with our affiliates and other third parties?

8. How long will we use, disclose or retain your Personal Information?

9. How can you review your Personal Information that we have collected, used or disclosed?

10. How do you know that the Personal Information we have on you is accurate?

11. What if the Personal Information we have on you is inaccurate?

12. How fast will we respond to your written requests?

13. Are there any costs to you for requesting information on your Personal Information or on our Privacy Policy or practices?

14. How do we know that it is really you requesting your Personal Information?

15. What safeguards have we implemented to protect your Personal Information?

16. How do you contact us regarding access to your Personal Information or our Privacy Policy and practices?

1. What is Personal Information?

“Personal Information” is any information that is identifiable with you as an individual. This information may include but is not limited to your name, email address, mailing address, telephone number, credit card number and any information that you provide to us in a manner that is identifiable to you. Personal Information, however, does not include your name, business title or business address and business telephone number in your capacity as an employee of an organization.

2. How do we collect your Personal Information?

We will always collect your Personal Information by fair and lawful means. We may collect Personal Information from you directly, and may collect Personal Information about you from third parties where we have obtained your consent to do so or as otherwise required or permitted by law.

3. Where do we store your Personal Information?

We store your Personal Information at our premises in Canada. Also, as we are affiliate with a U.S. parent company, we will store your Personal Information in the U.S. for the purposes set out above. While your Personal Information is in the U.S., it is subject to U.S. laws, and may be subject to disclosure to the governments, courts or law enforcement or regulatory agencies in the U.S., pursuant to applicable laws.

In addition, our service providers may, from time to time, also hold your Personal Information in connection with purposes for which you provided your consent. We may keep a record of your Personal Information, correspondence or comments in a file specific to you.

4. How do we use your Personal Information?

We identify the purposes for which we use your Personal Information at the time we collect such information from you and obtain your consent, in any case, prior to such use. We generally use your Personal Information for the following purposes (the “Purposes”): (i) to process your purchases; (ii) to provide customer service regarding your purchase transactions; (iii) to respond to your requests, complaints or inquiries; (iv) to assist you with administrative or technical support; (v) to provide you with information concerning products and services that we believe may be of interest to you; (vi) to enroll you in our contests or programs and to provide coupons; (vii) to determine the suitability of Noodles & Company’s products and services; or the eligibility of Individuals for those products and services; (viii) to carry out contractual obligations (ix) to collect your opinions and comments in regard to Noodles & Company operations; (x) for purposes of statistical research and demographic analysis; (xii) to investigate legal claims; (xiii) for such other purposes as you may otherwise consent from time to time and (xiv) to comply with applicable laws and regulations.

5. To whom do we provide your Personal Information?

We do not sell or disclose our client lists to third parties. We only make disclosures of Personal Information with your consent (and where we have identified the purpose and nature of the disclosure as part of obtaining your consent).

Notwithstanding the foregoing, we may make disclosures of Personal Information to a potential acquiror in connection with a transaction involving the sale of the business of Noodles & Company or as otherwise permitted or required by law.

Aside from disclosures, we may transfer your Personal Information to a third party service provider where that provider is assisting us with the Purposes. We are responsible for your personal information while it is handled by third party service providers on our behalf. Before transferring Personal Information to that provider, we will enter into a contract with that provider which includes appropriate privacy standards, as well as restrictions that limit the use or disclosure of your Personal Information.

6. When and how do we obtain your consent?

We generally obtain your consent prior to collecting, and in any case, prior to using or disclosing your Personal Information for any purpose. You may provide your consent to us either orally, electronically or in writing. The form of consent that we may seek, including whether it is express or implied, will largely depend on the sensitivity of the Personal Information and what would be reasonably expected in the circumstances.

7. How do we ensure the privacy of your Personal Information when dealing with our affiliates and other third parties?

We ensure that all affiliates and other third parties that are retained to perform services on our behalf and are provided with Personal Information are contractually required to observe the intent of this Privacy Statement and our Privacy Policy and practices.

8. How long will we use, disclose or retain your Personal Information?

We may keep a record of your Personal Information, correspondence or comments in a file specific to you. We will use, disclose or retain your Personal Information for as long as necessary to fulfill the purposes for which that Personal Information was collected and as permitted or required by law.

9. How can you review your Personal Information that we have collected, used or disclosed?

If you make a written request to review any Personal Information about you that we have collected, used or disclosed, we will provide you with any such Personal Information to the extent required by law. We will make such Personal Information available to you in a form that is generally understandable, and will explain any abbreviations or codes.

10. How do you know that the Personal Information we have on you is accurate?

We will ensure that your Personal Information is kept as accurate, complete and up-to-date as is necessary for the purposes for which it is to be used. We will not routinely update your Personal Information, unless such a process is necessary. We expect you, from time to time, to supply us with written updates to your Personal Information, when required.

11. What if the Personal Information we have on you is inaccurate?

At any time, you can challenge the accuracy or completeness of your Personal Information in our records. If you successfully demonstrate that your Personal Information in our records is inaccurate or incomplete, we will amend the Personal Information as required. Where appropriate, we will transmit the amended information to third parties having access to your Personal Information.

12. How fast will we respond to your written requests?

We will attempt to respond to each of your written requests not later than 30 days after receipt of such requests. We will advise you in writing if we cannot meet your requests within this time limit. You have the right to make a complaint to the Privacy Commissioner of Canada in respect of this time limit.

13. Are there any costs to you for requesting information about your Personal Information or our Privacy Policy or practices?

We will not charge any costs for you to access your Personal Information in our records or to access our Privacy Policy or practices without first providing you with an estimate of the approximate costs, if any. You may withdraw your requests for access to information by notifying us within the 30 day notice period disclosed on the estimate. If you do not notify us within such 30 day period, we will send you a further notice indicating that you will be deemed to have withdrawn your request for access unless you advise us otherwise within 30 days. If, after the expiry of this second 30 day period, you have not so advised us, we will deem your request to have been withdrawn and provide you with written notice to that effect.

14. How do we know that it is really you requesting your Personal Information?

We may request that you provide sufficient identification to permit access to the existence, use or disclosure of your Personal Information. Any such identifying information shall be used only for this purpose.

15. What safeguards have we implemented to protect your Personal Information?

We have implemented physical, organizational, contractual and technological security measures to protect your Personal Information from loss or theft, unauthorized access, disclosure, copying, use or modification. The only employees who are granted access to your Personal Information are those with a business ‘need-to-know’ or whose duties reasonably require such information.

16. How do you contact us regarding access to your Personal Information or our Privacy Policy and practices?

All comments, questions, concerns or complaints regarding your Personal Information or our Privacy Policy and practices, should be forwarded to our Privacy Officer as follows.